CVE-2025-32372 - CVE House

Back to Database

Status published Medium CVE-2025-32372

Server-Side Request Forgery (SSRF) in DotNetNuke.Core

6.5 CVSS

Vulnerability Description

DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously known vulnerability CVE-2017-0929, allowing unauthenticated attackers to execute arbitrary GET requests against target systems, including internal or adjacent networks. This vulnerability facilitates a semi-blind SSRF attack, allowing attackers to make the target server send requests to internal or external URLs without viewing the full responses. Potential impacts include internal network reconnaissance, bypassing firewalls. This vulnerability is fixed in 9.13.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32372

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from dnnsoftware

View All →

DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite

DNN vulnerable to stored cross-site-scripting (XSS) via SVG upload

DNN CKEditor Provider allows unauthenticated upload out-of-the-box

DNN vulnerable to Reflected Cross-Site Scripting (XSS) using url to profile

DNN Vulnerable to Reflected Cross-Site Scripting (XSS) in CKEditor File Browser

Affected Vendor

dnnsoftware

View all reports →

Affected Software

Dnn.Platform

Vulnerable Versions:

< 9.13.8

Timeline

Official Publish: April 9th, 2025

Last Modified: April 9th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery